CVE-2026-59167
SunEditor: Critical XSS vulnerability - sanitizer bypass
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.
| CWE | CWE-79 |
| Vendor | jihong88 |
| Product | suneditor |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for jihong88 suneditor
Be the first to know when new critical vulnerabilities affecting jihong88 suneditor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
JiHong88 / suneditor
< 2.47.11
References
github.com: https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4 github.com: https://github.com/JiHong88/suneditor/issues/1646 github.com: https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045 github.com: https://github.com/JiHong88/suneditor/releases/tag/2.47.11